Winpkfil & Lhmoni giving different ip addresses on same

[Manpreet Singh]

WinpkFilter and LHMonitor are giving different destination and source ip addresses on same packets.

i.e if we compare the port addresses of the same packet captured by the both they are same, but on same packet their Ip addresses are different.

I am using Tunnel mode in winpkfilter
Mode.dwFlags = STCP_FLAG_SENT_TUNNEL | STCP_FLAG_RECV_TUNNEL

This is the part of code, using these variables

tcphdr_ptr pTcp;
LOG_INFO LogInfo;
ADAPTER_MODE Mode;
iphdr_ptr pIp;

//they are equal

LogInfo.m_RemoteAddress.m_Port == ntohs(pTcp->th_dport)

LogInfo.m_LocalAddress.m_Port == ntohs(ptcp->th_sport)



//but addresses are not

LogInfo.m_RemoteAddress.m_Ip  !=  pIp->ip_dst.S_un.S_addr

[Author]

Posts